@xmldom/xmldom
npm23 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @xmldom/xmldompage 1 of 1
- CVE-2021-32796MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.7.02021-07-27
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their …
- CVE-2022-37616CRITICALCVSS 9.8EG 9.8✓ Fixed in 0.7.62022-10-11
vulnerable: 0.9.0-beta.1
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this repor…
- CVE-2022-39353CRITICALCVSS 9.4EG 9.4✓ Fixed in 0.9.0-beta.42022-11-02
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childN…
- CVE-2026-34601HIGHCVSS 7.5EG 7.5✓ Fixed in 0.9.92026-04-02
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlle…
- CVE-2026-41672HIGHCVSS 7.5EG 7.5✓ Fixed in 0.9.102026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled …
- CVE-2026-41673HIGHCVSS 7.5EG 7.5✓ Fixed in 0.9.102026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.j…
- CVE-2026-41674HIGHCVSS 7.5EG 7.5✓ Fixed in 0.9.102026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType nod…
- CVE-2026-41675HIGHCVSS 7.5EG 7.5✓ Fixed in 0.9.102026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled …
- CVE-2026-83605HIGHCVSS 8.7EG 8.7✓ Fixed in 0.8.142026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private…
- CVE-2026-83606HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.112026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char*? …
- CVE-2026-83607HIGHCVSS 8.7EG 8.7✓ Fixed in 0.8.142026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores a…
- CVE-2026-83608HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom…
- CVE-2026-83609HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline fl…
- CVE-2026-83610MEDIUMCVSS 6.3EG 6.3✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) acc…
- CVE-2026-83611MEDIUMCVSS 6.9EG 6.9✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently…
- CVE-2026-83612HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the scr…
- CVE-2026-83613HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parse…
- CVE-2026-83614HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can c…
- CVE-2026-83615HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _cop…
- CVE-2026-83616HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(tar…
- CVE-2026-83617HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
vulnerable: 0.9.11
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produ…
- CVE-2026-83618HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with Pubid…
- CVE-2026-83619HIGHCVSS 8.7EG 8.7✓ Fixed in 0.8.152026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[…
Check whether @xmldom/xmldom is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @xmldom/xmldom CVEs against the assets you own.
Start Free Scan →